<!doctype html>

<html>
<head>
  <link rel="shortcut icon" href="static/images/favicon.ico" type="image/x-icon">
  <title>sanitizer_test.js (Closure Library API Documentation - JavaScript)</title>
  <link rel="stylesheet" href="static/css/base.css">
  <link rel="stylesheet" href="static/css/doc.css">
  <link rel="stylesheet" href="static/css/sidetree.css">
  <link rel="stylesheet" href="static/css/prettify.css">

  <script>
     var _staticFilePath = "static/";
     var _typeTreeName = "goog";
     var _fileTreeName = "Source";
  </script>

  <script src="static/js/doc.js">
  </script>


  <meta charset="utf8">
</head>

<body onload="grokdoc.onLoad();">

<div id="header">
  <div class="g-section g-tpl-50-50 g-split">
    <div class="g-unit g-first">
      <a id="logo" href="index.html">Closure Library API Documentation</a>
    </div>

    <div class="g-unit">
      <div class="g-c">
        <strong>Go to class or file:</strong>
        <input type="text" id="ac">
      </div>
    </div>
  </div>
</div>

<div class="clear"></div>

<h2><a href="local_closure_goog_labs_html_sanitizer_test.js.html">sanitizer_test.js</a></h2>

<pre class="prettyprint lang-js">
<a name="line1"></a>// Copyright 2013 The Closure Library Authors. All Rights Reserved.
<a name="line2"></a>//
<a name="line3"></a>// Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
<a name="line4"></a>// you may not use this file except in compliance with the License.
<a name="line5"></a>// You may obtain a copy of the License at
<a name="line6"></a>//
<a name="line7"></a>//      http://www.apache.org/licenses/LICENSE-2.0
<a name="line8"></a>//
<a name="line9"></a>// Unless required by applicable law or agreed to in writing, software
<a name="line10"></a>// distributed under the License is distributed on an &quot;AS-IS&quot; BASIS,
<a name="line11"></a>// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
<a name="line12"></a>// See the License for the specific language governing permissions and
<a name="line13"></a>// limitations under the License.
<a name="line14"></a>
<a name="line15"></a>
<a name="line16"></a>goog.provide(&#39;goog.labs.html.SanitizerTest&#39;);
<a name="line17"></a>
<a name="line18"></a>goog.require(&#39;goog.html.SafeUrl&#39;);
<a name="line19"></a>goog.require(&#39;goog.labs.html.Sanitizer&#39;);
<a name="line20"></a>goog.require(&#39;goog.string&#39;);
<a name="line21"></a>goog.require(&#39;goog.string.Const&#39;);
<a name="line22"></a>goog.require(&#39;goog.testing.jsunit&#39;);
<a name="line23"></a>
<a name="line24"></a>goog.setTestOnly(&#39;goog.labs.html.SanitizerTest&#39;);
<a name="line25"></a>
<a name="line26"></a>
<a name="line27"></a>var JENNYS_PHONE_NUMBER = goog.html.SafeUrl.fromConstant(
<a name="line28"></a>    goog.string.Const.from(&#39;tel:867-5309&#39;));
<a name="line29"></a>
<a name="line30"></a>
<a name="line31"></a>var sanitizer = new goog.labs.html.Sanitizer()
<a name="line32"></a>    .allowElements(
<a name="line33"></a>        &#39;a&#39;, &#39;b&#39;, &#39;i&#39;, &#39;p&#39;, &#39;font&#39;, &#39;hr&#39;, &#39;br&#39;, &#39;span&#39;,
<a name="line34"></a>        &#39;ol&#39;, &#39;ul&#39;, &#39;li&#39;,
<a name="line35"></a>        &#39;table&#39;, &#39;tr&#39;, &#39;td&#39;, &#39;th&#39;, &#39;tbody&#39;,
<a name="line36"></a>        &#39;h1&#39;, &#39;h2&#39;, &#39;h3&#39;, &#39;h4&#39;, &#39;h5&#39;, &#39;h6&#39;,
<a name="line37"></a>        &#39;img&#39;,
<a name="line38"></a>        &#39;html&#39;, &#39;head&#39;, &#39;body&#39;, &#39;title&#39;
<a name="line39"></a>    )
<a name="line40"></a>    // allow unfiltered title attributes, and
<a name="line41"></a>    .allowAttributes(&#39;*&#39;, &#39;title&#39;)
<a name="line42"></a>    // specific dir values.
<a name="line43"></a>    .allowAttributes(
<a name="line44"></a>        &#39;*&#39;, &#39;dir&#39;,
<a name="line45"></a>        function(dir) { return dir === &#39;ltr&#39; || dir === &#39;rtl&#39; ? dir : null; })
<a name="line46"></a>    .allowAttributes(
<a name="line47"></a>        // Specifically on &lt;a&gt; elements,
<a name="line48"></a>        &#39;a&#39;,
<a name="line49"></a>        // allow an href but verify and rewrite, and
<a name="line50"></a>        &#39;href&#39;,
<a name="line51"></a>        function(href) {
<a name="line52"></a>          if (href === &#39;tel:867-5309&#39;) {
<a name="line53"></a>            return JENNYS_PHONE_NUMBER;
<a name="line54"></a>          }
<a name="line55"></a>          // Missing anchor is an intentional error.
<a name="line56"></a>          return /https?:\/\/google\.[a-z]{2,3}\/search\?/.test(String(href)) ?
<a name="line57"></a>              href : null;
<a name="line58"></a>        })
<a name="line59"></a>    .allowAttributes(
<a name="line60"></a>        &#39;a&#39;,
<a name="line61"></a>        // mask the generic title handler for no good reason.
<a name="line62"></a>        &#39;title&#39;,
<a name="line63"></a>        function(title) { return &#39;&lt;&#39; + title + &#39;&gt;&#39;; });
<a name="line64"></a>
<a name="line65"></a>
<a name="line66"></a>function run(input, golden, desc) {
<a name="line67"></a>  var actual = sanitizer.sanitize(input);
<a name="line68"></a>  assertEquals(desc, golden, actual);
<a name="line69"></a>}
<a name="line70"></a>
<a name="line71"></a>
<a name="line72"></a>function testEmptyString() {
<a name="line73"></a>  run(&#39;&#39;, &#39;&#39;, &#39;Empty string&#39;);
<a name="line74"></a>}
<a name="line75"></a>
<a name="line76"></a>function testHelloWorld() {
<a name="line77"></a>  run(&#39;Hello, &lt;b&gt;World&lt;/b&gt;!&#39;, &#39;Hello, &lt;b&gt;World&lt;/b&gt;!&#39;,
<a name="line78"></a>      &#39;Hello World&#39;);
<a name="line79"></a>}
<a name="line80"></a>
<a name="line81"></a>function testNoEndTag() {
<a name="line82"></a>  run(&#39;&lt;i&gt;Hello, &lt;b&gt;World!&#39;,
<a name="line83"></a>      &#39;&lt;i&gt;Hello, &lt;b&gt;World!&lt;/b&gt;&lt;/i&gt;&#39;,
<a name="line84"></a>      &#39;Hello World no end tag&#39;);
<a name="line85"></a>}
<a name="line86"></a>
<a name="line87"></a>function testUnclosedTags() {
<a name="line88"></a>  run(&#39;&lt;html&gt;&lt;head&gt;&lt;title&gt;Hello, &lt;&lt;World&gt;&gt;!&lt;/TITLE&gt;&#39; +
<a name="line89"></a>      &#39;&lt;/head&gt;&lt;body&gt;&lt;p&gt;Hello,&lt;Br&gt;&lt;&lt;World&gt;&gt;!&#39;,
<a name="line90"></a>      &#39;&lt;html&gt;&lt;head&gt;&lt;title&gt;Hello, &lt;&lt;World&gt;&gt;!&lt;/title&gt;&#39; +
<a name="line91"></a>      &#39;&lt;/head&gt;&lt;body&gt;&lt;p&gt;Hello,&lt;br&gt;&amp;lt;&amp;gt;!&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;&#39;,
<a name="line92"></a>      &#39;RCDATA content, different case, unclosed tags&#39;);
<a name="line93"></a>}
<a name="line94"></a>
<a name="line95"></a>function testListInList() {
<a name="line96"></a>  run(&#39;&lt;ul&gt;&lt;li&gt;foo&lt;/li&gt;&lt;ul&gt;&lt;li&gt;bar&lt;/li&gt;&lt;/ul&gt;&lt;/ul&gt;&#39;,
<a name="line97"></a>      &#39;&lt;ul&gt;&lt;li&gt;foo&lt;/li&gt;&lt;li&gt;&lt;ul&gt;&lt;li&gt;bar&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&#39;,
<a name="line98"></a>      &#39;list in list directly&#39;);
<a name="line99"></a>}
<a name="line100"></a>
<a name="line101"></a>function testHeaders() {
<a name="line102"></a>  run(&#39;&lt;h1&gt;header&lt;/h1&gt;body&#39; +
<a name="line103"></a>      &#39;&lt;H2&gt;sub-header&lt;/h3&gt;sub-body&#39; +
<a name="line104"></a>      &#39;&lt;h3&gt;sub-sub-&lt;/hr&gt;header&lt;hr&gt;&lt;/hr&gt;sub-sub-body&lt;/H4&gt;&lt;/h2&gt;&#39;,
<a name="line105"></a>      &#39;&lt;h1&gt;header&lt;/h1&gt;body&#39; +
<a name="line106"></a>      &#39;&lt;h2&gt;sub-header&lt;/h2&gt;sub-body&#39; +
<a name="line107"></a>      &#39;&lt;h3&gt;sub-sub-header&lt;/h3&gt;&lt;hr&gt;sub-sub-body&#39;,
<a name="line108"></a>      &#39;headers&#39;);
<a name="line109"></a>}
<a name="line110"></a>
<a name="line111"></a>function testListNesting() {
<a name="line112"></a>  run(&#39;&lt;ul&gt;&lt;li&gt;&lt;ul&gt;&lt;li&gt;foo&lt;/li&gt;&lt;/li&gt;&lt;ul&gt;&lt;li&gt;bar&#39;,
<a name="line113"></a>      &#39;&lt;ul&gt;&lt;li&gt;&lt;ul&gt;&lt;li&gt;foo&lt;/li&gt;&lt;li&gt;&lt;ul&gt;&lt;li&gt;bar&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&#39;,
<a name="line114"></a>      &#39;list nesting&#39;);
<a name="line115"></a>}
<a name="line116"></a>
<a name="line117"></a>function testTableNesting() {
<a name="line118"></a>  run(&#39;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;th&gt;bar&lt;/table&gt;&lt;/table&gt;&#39;,
<a name="line119"></a>      &#39;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;foo&lt;/td&gt;&lt;td&gt;&#39; +
<a name="line120"></a>      &#39;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;th&gt;bar&lt;/th&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&#39; +
<a name="line121"></a>      &#39;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&#39;,
<a name="line122"></a>      &#39;table nesting&#39;);
<a name="line123"></a>}
<a name="line124"></a>
<a name="line125"></a>function testNestingLimit() {
<a name="line126"></a>  run(goog.string.repeat(&#39;&lt;span&gt;&#39;, 264) + goog.string.repeat(&#39;&lt;/span&gt;&#39;, 264),
<a name="line127"></a>      goog.string.repeat(&#39;&lt;span&gt;&#39;, 256) + goog.string.repeat(&#39;&lt;/span&gt;&#39;, 256),
<a name="line128"></a>      &#39;264 open spans&#39;);
<a name="line129"></a>}
<a name="line130"></a>
<a name="line131"></a>function testTableScopes() {
<a name="line132"></a>  run(&#39;&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;p&gt;Hi&lt;/p&gt;&lt;p&gt;How are you&lt;/p&gt;\n&#39; +
<a name="line133"></a>      &#39;&lt;p&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&#39; +
<a name="line134"></a>      &#39;&lt;td&gt;&lt;b&gt;&lt;font&gt;&lt;font&gt;&lt;p&gt;Cell&lt;/b&gt;&lt;/font&gt;&lt;/font&gt;&lt;/p&gt;\n&lt;/td&gt;&#39; +
<a name="line135"></a>      &#39;&lt;td&gt;&lt;b&gt;&lt;font&gt;&lt;font&gt;&lt;p&gt;Cell&lt;/b&gt;&lt;/font&gt;&lt;/font&gt;&lt;/p&gt;\n&lt;/td&gt;&#39; +
<a name="line136"></a>      &#39;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/p&gt;\n&#39; +
<a name="line137"></a>      &#39;&lt;p&gt;x&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;&#39;,
<a name="line138"></a>
<a name="line139"></a>      &#39;&lt;html&gt;&lt;head&gt;&lt;/head&gt;&lt;body&gt;&lt;p&gt;Hi&lt;/p&gt;&lt;p&gt;How are you&lt;/p&gt;\n&#39; +
<a name="line140"></a>      &#39;&lt;p&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&#39; +
<a name="line141"></a>      &#39;&lt;td&gt;&lt;b&gt;&lt;font&gt;&lt;font&gt;&lt;/font&gt;&lt;/font&gt;&lt;/b&gt;&lt;p&gt;Cell&lt;/p&gt;\n&lt;/td&gt;&#39; +
<a name="line142"></a>      // The close &lt;/p&gt; tag does not close the whole table. +
<a name="line143"></a>      &#39;&lt;td&gt;&lt;b&gt;&lt;font&gt;&lt;font&gt;&lt;/font&gt;&lt;/font&gt;&lt;/b&gt;&lt;p&gt;Cell&lt;/p&gt;\n&lt;/td&gt;&#39; +
<a name="line144"></a>      &#39;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/p&gt;\n&#39; +
<a name="line145"></a>      &#39;&lt;p&gt;x&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;&#39;,
<a name="line146"></a>
<a name="line147"></a>      &#39;Table Scopes&#39;);
<a name="line148"></a>}
<a name="line149"></a>
<a name="line150"></a>function testConcatSafe() {
<a name="line151"></a>  run(&#39;&lt;&lt;applet&gt;script&lt;applet&gt;&gt;alert(1337)&lt;&lt;!-- --&gt;/script&lt;?...?&gt;&gt;&#39;,
<a name="line152"></a>      &#39;&amp;lt;script&amp;gt;alert(1337)&amp;lt;/script&amp;gt;&#39;,
<a name="line153"></a>      &#39;Concat safe&#39;);
<a name="line154"></a>}
<a name="line155"></a>
<a name="line156"></a>function testPrototypeMembersDoNotInfectTables() {
<a name="line157"></a>  // Constructor is all lower-case so will survive tag name
<a name="line158"></a>  // normalization.
<a name="line159"></a>  run(&#39;&lt;constructor&gt;Foo&lt;/constructor&gt;&#39;, &#39;Foo&#39;,
<a name="line160"></a>      &#39;Object.prototype members&#39;);
<a name="line161"></a>}
<a name="line162"></a>
<a name="line163"></a>function testGenericAttributesAllowed() {
<a name="line164"></a>  run(&#39;&lt;span title=howdy&gt;&lt;/span&gt;&#39;, &#39;&lt;span title=&quot;howdy&quot;&gt;&lt;/span&gt;&#39;,
<a name="line165"></a>      &#39;generic attrs allowed&#39;);
<a name="line166"></a>}
<a name="line167"></a>
<a name="line168"></a>function testValueWhitelisting() {
<a name="line169"></a>  run(&#39;&lt;span dir=\&#39;ltr\&#39;&gt;LTR&lt;/span&gt;&lt;span dir=\&#39;evil\&#39;&gt;Evil&lt;/span&gt;&#39;,
<a name="line170"></a>      &#39;&lt;span dir=&quot;ltr&quot;&gt;LTR&lt;/span&gt;&lt;span&gt;Evil&lt;/span&gt;&#39;,
<a name="line171"></a>      &#39;value whitelisted&#39;);
<a name="line172"></a>}
<a name="line173"></a>
<a name="line174"></a>function testAttributeNormalization() {
<a name="line175"></a>  run(&#39;&lt;a href=&quot;http://google.com/search?q=tests suxor&amp;hl=en&quot;&gt;Click&lt;/a&gt;&#39;,
<a name="line176"></a>      &#39;&lt;a href=&quot;http://google.com/search?q=tests%20suxor&amp;amp;hl=en&quot;&gt;Click&lt;/a&gt;&#39;,
<a name="line177"></a>      &#39;URL normalized&#39;);
<a name="line178"></a>}
<a name="line179"></a>
<a name="line180"></a>function testNaiveAttributeRewriterCaught() {
<a name="line181"></a>  run(&#39;&lt;a href=&quot;javascript:http://google.com/&amp;#10;alert(1337)&quot;&gt;sneaky&lt;/a&gt;&#39;,
<a name="line182"></a>      &#39;&lt;a&gt;sneaky&lt;/a&gt;&#39;,
<a name="line183"></a>      &#39;Safety net saves naive attribute rewriters&#39;);
<a name="line184"></a>}
<a name="line185"></a>
<a name="line186"></a>function testSafeUrlFromAttributeRewriter() {
<a name="line187"></a>  run(&#39;&lt;a href=&quot;tel:867-5309&quot;&gt;Jenny&lt;/a&gt;&#39;, &#39;&lt;a href=&quot;tel:867-5309&quot;&gt;Jenny&lt;/a&gt;&#39;,
<a name="line188"></a>      &#39;Attribute rewriter escapes safety checks via SafeURL&#39;);
<a name="line189"></a>}
<a name="line190"></a>
<a name="line191"></a>function testTagSpecificityOfAttributeFiltering() {
<a name="line192"></a>  run(&#39;&lt;img href=&quot;http://google.com/search?q=tests+suxor&quot;&gt;&#39;,
<a name="line193"></a>      &#39;&lt;img&gt;&#39;,
<a name="line194"></a>      &#39;href blocked on img&#39;);
<a name="line195"></a>}
<a name="line196"></a>
<a name="line197"></a>function testTagSpecificAttributeFiltering() {
<a name="line198"></a>  run(&#39;&lt;a href=&quot;http://google.evil.com/search?q=tests suxor&quot;&gt;Unclicky&lt;/a&gt;&#39;,
<a name="line199"></a>      &#39;&lt;a&gt;Unclicky&lt;/a&gt;&#39;,
<a name="line200"></a>      &#39;bad href value blocked&#39;);
<a name="line201"></a>}
<a name="line202"></a>
<a name="line203"></a>function testNonWhitelistFunctionsNotCalled() {
<a name="line204"></a>  var called = false;
<a name="line205"></a>  Object.prototype.dontcallme = function() {
<a name="line206"></a>    called = true;
<a name="line207"></a>    return &#39;dontcallme was called despite being on the prototype&#39;;
<a name="line208"></a>  };
<a name="line209"></a>  try {
<a name="line210"></a>    run(&#39;&lt;span dontcallme=&quot;I\&#39;ll call you&quot;&gt;Lorem Ipsum&#39;,
<a name="line211"></a>        &#39;&lt;span&gt;Lorem Ipsum&lt;/span&gt;&#39;,
<a name="line212"></a>        &#39;non white-list fn not called&#39;);
<a name="line213"></a>  } finally {
<a name="line214"></a>    delete Object.prototype.dontcallme;
<a name="line215"></a>  }
<a name="line216"></a>  assertFalse(&#39;Object.prototype.dontcallme should not have been called&#39;,
<a name="line217"></a>              called);
<a name="line218"></a>}
<a name="line219"></a>
<a name="line220"></a>function testQuotesInAttributeValue() {
<a name="line221"></a>  run(&#39;&lt;span tItlE =\n\&#39;Quoth the raven, &quot;Nevermore&quot;\&#39;&gt;Lorem Ipsum&#39;,
<a name="line222"></a>      &#39;&lt;span title=&quot;Quoth the raven, &amp;quot;Nevermore&amp;quot;&quot;&gt;Lorem Ipsum&lt;/span&gt;&#39;,
<a name="line223"></a>      &#39;quotes in attr value&#39;);
<a name="line224"></a>}
<a name="line225"></a>
<a name="line226"></a>function testAttributesNeverMentionedAreDropped() {
<a name="line227"></a>  run(&#39;&lt;b onclick=&quot;evil=true&quot;&gt;evil&lt;/b&gt;&#39;, &#39;&lt;b&gt;evil&lt;/b&gt;&#39;, &#39;attrs white-listed&#39;);
<a name="line228"></a>}
<a name="line229"></a>
<a name="line230"></a>function testAttributesNotOverEscaped() {
<a name="line231"></a>  run(&#39;&lt;I TITLE=&quot;Foo &amp;AMP; Bar &amp; Baz&quot;&gt;/&lt;/I&gt;&#39;,
<a name="line232"></a>      &#39;&lt;i title=&quot;Foo &amp;amp; Bar &amp;amp; Baz&quot;&gt;/&lt;/i&gt;&#39;,
<a name="line233"></a>      &#39;attr value not over-escaped&#39;);
<a name="line234"></a>}
<a name="line235"></a>
<a name="line236"></a>function testTagSpecificRulesTakePrecedence() {
<a name="line237"></a>  run(&#39;&lt;a title=zogberts&gt;Link&lt;/a&gt;&#39;,
<a name="line238"></a>      &#39;&lt;a title=&quot;&amp;lt;zogberts&amp;gt;&quot;&gt;Link&lt;/a&gt;&#39;,
<a name="line239"></a>      &#39;tag specific rules take precedence&#39;);
<a name="line240"></a>}
<a name="line241"></a>
<a name="line242"></a>function testAttributeRejectionLocalized() {
<a name="line243"></a>  run(&#39;&lt;a id=foo href =//evil.org/ title=&gt;Link&lt;/a&gt;&#39;,
<a name="line244"></a>      &#39;&lt;a title=&quot;&amp;lt;&amp;gt;&quot;&gt;Link&lt;/a&gt;&#39;,
<a name="line245"></a>      &#39;failure of one attribute does not torpedo others&#39;);
<a name="line246"></a>}
<a name="line247"></a>
<a name="line248"></a>function testWeirdHtmlRulesFollowedForAttrValues() {
<a name="line249"></a>  run(&#39;&lt;span title= id=&gt;Lorem Ipsum&lt;/span&gt;&#39;,
<a name="line250"></a>      &#39;&lt;span title=\&quot;id=\&quot;&gt;Lorem Ipsum&lt;/span&gt;&#39;,
<a name="line251"></a>      &#39;same as browser on weird values&#39;);
<a name="line252"></a>}
<a name="line253"></a>
<a name="line254"></a>function testAttributesDisallowedOnCloseTags() {
<a name="line255"></a>  run(&#39;&lt;h1 title=&quot;open&quot;&gt;Header&lt;/h1 title=&quot;closed&quot;&gt;&#39;,
<a name="line256"></a>      &#39;&lt;h1 title=&quot;open&quot;&gt;Header&lt;/h1&gt;&#39;,
<a name="line257"></a>      &#39;attributes on close tags&#39;);
<a name="line258"></a>}
<a name="line259"></a>
<a name="line260"></a>function testRoundTrippingOfHtmlSafeAgainstIEBacktickProblems() {
<a name="line261"></a>  // Introducing a space at the end of an attribute forces IE to quote it when
<a name="line262"></a>  // turning a DOM into innerHTML which protects against a bunch of problems
<a name="line263"></a>  // with backticks since IE treats them as attribute value delimiters, allowing
<a name="line264"></a>  //   foo.innerHTML += ...
<a name="line265"></a>  // to continue to &quot;work&quot; without introducing an XSS vector.
<a name="line266"></a>  // Adding a space at the end is innocuous since HTML attributes whose values
<a name="line267"></a>  // are structured content ignore spaces at the beginning or end.
<a name="line268"></a>  run(&#39;&lt;span title=&quot;`backtick&quot;&gt;*&lt;/span&gt;&#39;, &#39;&lt;span title=&quot;`backtick &quot;&gt;*&lt;/span&gt;&#39;,
<a name="line269"></a>      &#39;not round-trippable on IE&#39;);
<a name="line270"></a>}
</pre>


</body>
</html>
